Index: [Article Count Order] [Thread]

Date:  Tue, 25 Nov 2008 12:36:51 -0600
From:  "Gerald Waugh" <gwaugh (at mark) frontstreetnetworks.com>
Subject:  [coba-e:14383] Re: Dovecot/POP3 Flood
To:  <coba-e (at mark) bluequartz.org>
Message-Id:  <009501c94f2c$cc3fd320$6401a8c0@systemax>
In-Reply-To:  <F9F62441D6374D4FB809B4CB98F54A5A@OfficeKen>
X-Mail-Count: 14383

Ken Marcus wrote; Tuesday, November 25, 2008 11:29 AM
User Ernie wrote;
> 
> >I am still having problems with these brute force attacks, 
> the problem
> >seems
> > to be that dovecot is spawing too many processes->PAM 
> requests before the
> > intrusion detection progam has notices. Is there a way to 
> hard code the
> > number of simultaneous running dovecot processes to give 
> time for the
> > blocking scripts to respond. Something like 50 dovcot 
> pop3-login processes
> > at once should be heaps.
> >
> >> On Sun, Sep 07, 2008 at 08:14:51PM +0200, Maurice de Laat wrote:
> >>
> >> > wget http://rfxnetworks.com/apf.php
> >>
> >> Make that wget http://www.r-fx.ca/downloads/apf-current.tar.gz
> >> Sorry for the confusion.
> >> --
> >> Maurice de Laat
> >>
> 
> As far as I know, the standard BFD does not work with Dovecot.
> 

We switched many servers to use the flat-password-file system, and looks
like it works!
Originally by NuOnce, can't find the URL...
We use the follwing;
http://fsn.raqware.com/flat-password-file-conversion

Gerald